CVE-2026-2303: Heap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leak

Deferred

AliasesSUSE-RU-2026:2815-1CGA-2238-mwvc-fj99CGA-247p-9qp7-56fr+967 more

Published 10-02-2026Last modified 11-02-2026

Vulnerability summary

CVE-2026-2303 is a medium (CVSS 6.9) Permissive List of Allowed Inputs vulnerability in mongodb inc mongodb go driver. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 24.8% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 6.9, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.9/10

010

Medium · v4.0 (CVE.org)

EPSS score

0.32%

0%100%

Low · +0.08 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 13 · Related 14

OPENSUSE-SU-2026:11684-1 OPENSUSE-SU-2026:11803-1 OPENSUSE-SU-2026:21551-1 OPENSUSE-SU-2026:22027-1 OPENSUSE-SU-2026:22032-1 OPENSUSE-SU-2026:22125-1+8 more

Timeline

10-02-2026
PublishedVulnerability first disclosed.
11-02-2026
Last modifiedVulnerability information updated.

Description

The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.

CVSS metrics

10 scores · 5 sources · 2 versions

v4.06.9v3.16.5

EPSS trend

Probability

0.32%

Chance of exploitation in the next 30 days

Percentile

25%

Versus all other CVEs

30-day change

Increase +0.08 pp

From 0.24% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-183Permissive List of Allowed InputsThe product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.

Affected systems

Version check

Known conditions: network-reachable, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard200 products

agentbeat< 9.2.7-r14
agentbeat-fips< 9.2.7-r13
amazon-cloudwatch-agentAll versions (No fix recorded) | < 1.300073.0-r1 | < 1.300070.0-r2
amazon-cloudwatch-agent-fips< 1.300070.0-r0
argo-cd-3.0All versions (No fix recorded)

argo-cd-3.0-compatAll versions (No fix recorded)
argo-cd-3.1All versions (No fix recorded)
argo-cd-3.1-compatAll versions (No fix recorded)
argo-cd-3.2< 3.2.12-r3
argo-cd-3.2-compat< 3.2.12-r3
argo-cd-3.3< 3.3.12-r2
argo-cd-3.3-compat< 3.3.12-r2 | All versions (No fix recorded)
argo-cd-fips-3.0All versions (No fix recorded)
argo-cd-fips-3.0-compatAll versions (No fix recorded)
argo-cd-fips-3.1All versions (No fix recorded)
argo-cd-fips-3.1-compatAll versions (No fix recorded)
argo-cd-fips-3.2< 3.2.12-r7
argo-cd-fips-3.2-compat< 3.2.12-r7
argo-cd-fips-3.3< 3.3.12-r1
argo-cd-fips-3.3-compat< 3.3.12-r1
authentik-2025.12-go-server< 2025.12.6-r15
authentik-2026.2-go-server< 2026.2.4-r7
authentik-fips-2025.12-go-server< 2025.12.6-r15
authentik-fips-2026.2-go-server< 2026.2.4-r5
bento< 1.18.1-r2
bento-fips< 1.18.1-r1
cilium-1.16All versions (No fix recorded)
cilium-1.16-clustermesh-apiserverAll versions (No fix recorded)
cilium-1.16-hubble-relayAll versions (No fix recorded)
cilium-1.16-operator-awsAll versions (No fix recorded)
cilium-1.16-operator-genericAll versions (No fix recorded)
cilium-1.17< 1.17.17-r2
cilium-1.17-clustermesh-apiserver< 1.17.17-r2
cilium-1.17-hubble-relay< 1.17.17-r2
cilium-1.17-operator-aws< 1.17.17-r2
cilium-1.17-operator-generic< 1.17.17-r2
cilium-1.18< 1.18.11-r2
cilium-1.18-clustermesh-apiserver< 1.18.11-r2
cilium-1.18-hubble-relay< 1.18.11-r2
cilium-1.18-operator-aws< 1.18.11-r2
cilium-1.18-operator-generic< 1.18.11-r2
cilium-1.19< 1.19.5-r2
cilium-1.19-clustermesh-apiserver< 1.19.5-r2
cilium-1.19-hubble-relay< 1.19.5-r2
cilium-1.19-operator-aws< 1.19.5-r2
cilium-1.19-operator-generic< 1.19.5-r2 | All versions (No fix recorded)
cilium-fips-1.16All versions (No fix recorded)
cilium-fips-1.16-clustermesh-apiserverAll versions (No fix recorded)
cilium-fips-1.16-host-utilsAll versions (No fix recorded)
cilium-fips-1.16-hubble-relayAll versions (No fix recorded)
cilium-fips-1.16-operator-awsAll versions (No fix recorded)
cilium-fips-1.16-operator-azureAll versions (No fix recorded)
cilium-fips-1.16-operator-genericAll versions (No fix recorded)
cilium-fips-1.17< 1.17.17-r2
cilium-fips-1.17-clustermesh-apiserver< 1.17.17-r2
cilium-fips-1.17-host-utils< 1.17.17-r2
cilium-fips-1.17-hubble-relay< 1.17.17-r2
cilium-fips-1.17-operator-aws< 1.17.17-r2
cilium-fips-1.17-operator-azure< 1.17.17-r2
cilium-fips-1.17-operator-generic< 1.17.17-r2
cilium-fips-1.18< 1.18.11-r2
cilium-fips-1.18-clustermesh-apiserver< 1.18.11-r2
cilium-fips-1.18-host-utils< 1.18.11-r2
cilium-fips-1.18-hubble-relay< 1.18.11-r2
cilium-fips-1.18-operator-aws< 1.18.11-r2
cilium-fips-1.18-operator-azure< 1.18.11-r2
cilium-fips-1.18-operator-generic< 1.18.11-r2
cilium-fips-1.19< 1.19.5-r2
cilium-fips-1.19-clustermesh-apiserver< 1.19.5-r2
cilium-fips-1.19-host-utils< 1.19.5-r2
cilium-fips-1.19-hubble-relay< 1.19.5-r2
cilium-fips-1.19-operator-aws< 1.19.5-r2
cilium-fips-1.19-operator-azure< 1.19.5-r2
cilium-fips-1.19-operator-generic< 1.19.5-r2
cloudbeat-8.17< 8.17.10-r25
cloudbeat-9.0< 9.0.8-r27
cloudbeat-9.1< 9.1.10-r19
cloudbeat-9.2< 9.2.8-r7
cloudbeat-fips-8.17< 8.17.10-r30
cloudbeat-fips-9.0< 9.0.8-r30
cloudbeat-fips-9.1< 9.1.10-r23
cloudbeat-fips-9.2< 9.2.8-r6
commercial-grafana-11.6All versions (No fix recorded)
commercial-grafana-12.1All versions (No fix recorded)
commercial-grafana-12.2All versions (No fix recorded)
commercial-grafana-12.3All versions (No fix recorded)
commercial-grafana-12.4< 12.4.10-r0
commercial-kyverno-1.14All versions (No fix recorded)
commercial-kyverno-1.15All versions (No fix recorded)
commercial-kyverno-1.16All versions (No fix recorded)
commercial-kyverno-1.17< 1.17.2-r0
commercial-kyverno-background-controller-1.14All versions (No fix recorded)
commercial-kyverno-background-controller-1.15All versions (No fix recorded)
commercial-kyverno-background-controller-1.16All versions (No fix recorded)
commercial-kyverno-background-controller-1.17< 1.17.2-r0
commercial-kyverno-cleanup-controller-1.14All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.15All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.16All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.17< 1.17.2-r0
commercial-kyverno-reports-controller-1.14All versions (No fix recorded)
commercial-kyverno-reports-controller-1.15All versions (No fix recorded)
commercial-kyverno-reports-controller-1.16All versions (No fix recorded)
commercial-kyverno-reports-controller-1.17< 1.17.2-r0
commercial-kyvernopre-1.14All versions (No fix recorded)
commercial-kyvernopre-1.15All versions (No fix recorded)
commercial-kyvernopre-1.16All versions (No fix recorded)
commercial-kyvernopre-1.17< 1.17.2-r0
consul-1.18All versions (No fix recorded)
consul-1.19All versions (No fix recorded)
consul-1.20All versions (No fix recorded)
consul-1.21< 1.21.5-r19
consul-fips-1.20All versions (No fix recorded)
consul-fips-1.21< 1.21.5-r20
consul-k8s-1.1-cli< 1.1.18-r39
consul-k8s-1.3-cli< 1.3.9-r43
consul-k8s-1.4-cli< 1.4.10-r29
consul-k8s-1.5-cli< 1.5.9-r32
consul-k8s-1.6-cli< 1.6.10-r22
consul-k8s-1.7-cli< 1.7.13-r11
consul-k8s-1.9-cli< 1.9.8-r4
consul-k8s-fips-1.1-cli< 1.1.18-r38
consul-k8s-fips-1.3-cli< 1.3.9-r39
consul-k8s-fips-1.4-cli< 1.4.10-r29
consul-k8s-fips-1.5-cli< 1.5.9-r34
consul-k8s-fips-1.6-cli< 1.6.10-r23
consul-k8s-fips-1.7-cli< 1.7.13-r14
consul-k8s-fips-1.9-cli< 1.9.8-r3
cortex< 1.21.1-r3
cortex-fips< 1.21.1-r2
dapr-daprd-1.14All versions (No fix recorded)
dapr-daprd-1.15< 1.15.14-r8
dapr-daprd-1.16< 1.16.16-r1
dapr-daprd-1.17< 1.17.10-r1
dapr-daprd-1.18< 1.18.1-r1
dapr-daprd-fips-1.14All versions (No fix recorded)
dapr-daprd-fips-1.15< 1.15.14-r7
dapr-daprd-fips-1.16< 1.16.16-r1
dapr-daprd-fips-1.17< 1.17.10-r1
dapr-daprd-fips-1.18< 1.18.1-r1
datadog-agent-7.71-fullAll versions (No fix recorded)
datadog-agent-7.72-fullAll versions (No fix recorded)
datadog-agent-7.73-full< 7.73.3-r23
datadog-agent-7.74-full< 7.74.1-r24
datadog-agent-7.75-fullAll versions (No fix recorded)
datadog-agent-7.76< 7.76.3-r27 | All versions (No fix recorded)
datadog-agent-7.76-full< 7.76.3-r27
datadog-agent-7.77< 7.77.3-r19
datadog-agent-7.78< 7.78.4-r11
datadog-agent-7.79< 7.79.2-r11
datadog-agent-7.80< 7.80.4-r3
datadog-agent-fips-7.71-fullAll versions (No fix recorded)
datadog-agent-fips-7.72-fullAll versions (No fix recorded)
datadog-agent-fips-7.73-full< 7.73.3-r26
datadog-agent-fips-7.74-full< 7.74.1-r26
datadog-agent-fips-7.75-fullAll versions (No fix recorded)
datadog-agent-fips-7.76< 7.76.3-r25
datadog-agent-fips-7.76-full< 7.76.3-r25
datadog-agent-fips-7.77< 7.77.3-r20 | < 7.77.3-r19
datadog-agent-fips-7.78< 7.78.4-r10
datadog-agent-fips-7.79< 7.79.2-r3
datadog-agent-fips-7.80< 7.80.4-r2
datadog-cluster-agent-7.77< 7.77.3-r19
datadog-cluster-agent-7.78< 7.78.4-r11
datadog-cluster-agent-7.79< 7.79.2-r11
datadog-cluster-agent-7.80< 7.80.4-r3
datadog-cluster-agent-fips-7.77< 7.77.3-r19
datadog-cluster-agent-fips-7.78< 7.78.4-r10
datadog-cluster-agent-fips-7.79< 7.79.2-r3
datadog-cluster-agent-fips-7.80< 7.80.4-r2
elastic-agent-9.1All versions (No fix recorded)
elastic-agent-9.2All versions (No fix recorded)
elastic-agent-fips-9.1All versions (No fix recorded)
elastic-agent-fips-9.2All versions (No fix recorded)
elastic-otel-collector-9.3< 9.3.6-r0
elastic-otel-collector-9.4< 9.4.3-r2 | < 9.4.3-r0
elastic-otel-collector-fips-9.3< 9.3.6-r0
elastic-otel-collector-fips-9.4< 9.4.2-r2
external-secrets-fips< 2.6.0-r1
external-secrets-operator-1.1All versions (No fix recorded)
external-secrets-operator-1.2All versions (No fix recorded)
external-secrets-operator-1.3All versions (No fix recorded)
external-secrets-operator-2.0All versions (No fix recorded)
external-secrets-operator-2.1All versions (No fix recorded)
external-secrets-operator-2.2< 2.2.0-r15
external-secrets-operator-2.3< 2.3.0-r12
external-secrets-operator-2.4< 2.4.1-r9
external-secrets-operator-2.5< 2.5.0-r6
external-secrets-operator-2.6< 2.6.0-r2
external-secrets-operator-fips-1.1All versions (No fix recorded)
external-secrets-operator-fips-1.2All versions (No fix recorded)
external-secrets-operator-fips-1.3All versions (No fix recorded)
external-secrets-operator-fips-2.0All versions (No fix recorded)
external-secrets-operator-fips-2.1All versions (No fix recorded)
external-secrets-operator-fips-2.2< 2.2.0-r15
external-secrets-operator-fips-2.3< 2.3.0-r11
external-secrets-operator-fips-2.4< 2.4.1-r8
external-secrets-operator-fips-2.5< 2.5.0-r6
external-secrets-operator-fips-2.6< 2.6.0-r1
ferretdb< 2.7.0-r20 | < 2.7.0-r22
google-cloud-otel-ops-collector< 0.151.0-r4

Show all 200

1 vendor · 200 products · Showing 200 of 507

References

7 links

jira.mongodb.org/browse/GODRIVER-3770WEB
www.suse.com/support/update/announcement/-2026-2815/suse-ru-20262815-1/Advisory
bugzilla.suse.com/1270529REPORT
www.suse.com/security/cve/CVE-2026-2303WEB
nvd.nist.gov/vuln/detail/CVE-2026-2303AdvisoryOval
github.com/mongodb/mongo-go-driverPACKAGE
github.com/advisories/GHSA-cp6g-7hqx-qxhpAdvisory